In terms of internal controls and anti-bribery compliance programs, all too often the internal controls or the compliance programs exist only in form. Well-written policies and procedures are useless unless they are actually implemented and actively enforced. The critical consideration is not whether or how they are written. Rather, the critical consideration is what really happens. The U.S. Securities and Exchange Commission’s resolution with Vantage Drilling International (“Vantage”) emphasizes this point.1
Vantage’s parent, Vantage Drilling Company (“VDC”), was an issuer and fully subject to the accounting and record-keeping provisions as was Vantage.2 VDC had in place internal controls that called for due diligence to be performed on third parties.3 “VDC policies required due diligence and prudent safeguards against improper payment to be in place with an agent on its behalf with regards to foreign governments on international business development before retaining the agent ….”4
VDC retained an agent to act on its behalf “in responding to a market inquiry released by Petrobras’ International Division (“PBID”).”5 The market inquiry was “in connection with obtaining an 8-year drilling services contract valued at over $1.8 billion.”6 PDIC was a division of Petroleo Brasileiro SA Petrobras (“Petrobras”), a Brazilian state-owned oil and gas company.7 However, the Order Instituting Cease-and-Desist Proceedings found that VDC disregarded its own internal controls, and in particular, its anticorruption compliance program, in failing to conduct any due diligence on the agent it retained.8 VDC also failed to undertake any due diligence on an individual and his companies before adding him to its board of directors and relying on him “as its sole source of drilling equipment and appointing him to its board of directors.”9
The Cease-and-Desist Order found that none of the “prudent safeguards” of its internal controls were followed with respect to agents interacting with foreign governments as part of business developments.10 Indeed, the Order noted that “VDC’s internal accounting controls in regards to its transactions with [the director] were insufficient in relation to the heightened risk of conducting business in the oil and gas industry in Brazel.”11 Moreover, when there were “red flags” suggesting the possibility of improper inducements being made, VDC officials also failed to follow up or inquire as required by its internal controls.12
The gist of the findings of the Cease-and-Desist Order was not the absence of an anticorruption compliance program. Rather, it was VDC’s “ineffective anticorruption compliance program.”13 The failure to actively implement and enforce its anticorruption compliance program constituted the underlying basis for the violation of the internal controls provisions.14
2Id. at ¶ 3.
3Id. at ¶ 26.
4Id. at ¶ 9.
6Id. at ¶ 2.
8Id. at ¶¶ 1, 9.
9Id. at ¶ 2.
11Id. at 24.
1415 U.S.C. § 78m(b)(2)(B).